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Abstract We study controlled quantum secure direct communication (CQSDC), 
a cryptographic scheme where a sender can send a secret bit-string to an in¬ 
tended recipient, without any secure classical channel, who can obtain the 
complete bit-string only with the permission of a controller. We report an 
efficient protocol to realize CQSDC using Cluster state and then go on to 
construct a (2-3)-CQSDC using Brown state, where a coalition of any two of 
the three controllers is required to retrieve the complete message. We argue 
both protocols to be unconditionally secure and analyze the efficiency of the 
protocols to show it to outperform the existing schemes while maintaining the 
same security specifications. 
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1 Introduction 

Establishing secure communication between two (or more) parties, without 
any undesirable leakage of information, is the ultimate goal of cryptography. 
While a conventional way of achieving this is to have a key (pair) shared 
among the participating parties, with at least one of the key (pair) to be 
private. Quantum Key Distribution (QKD) protocols [1] tend to facilitate 
such pursuits, in practice. Another way to accomplish this task is through 
Quantum Secure Direct Communication (QSDC). The first QSDC protocol, 
where the message is encoded in the EPR quantum states was given by Long 
et ah, [5]. Seminal works by Beige et ah, [3] and further developed by Bostrbm 
et ah, [4] and Deng et ah, [3, among others, that permits the secret messages 
to be transmitted directly among the desired parties without any pre-shared 
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key. Such protocols have been well studied in the recent years, and effective 
protocols have been proposed utilizing single photon resources [B] , Bell states 
[7] [ 8 ] [9] , GHZ states [T^ [11] , GHZ-like states [12] and W states [T3] [14] [15] . 

The idea of ’controlled communication’, where a controller’s permission is 
required to completely facilitate a communication, was introduced by Zutowski 
et ah, [16]. Recents works due to [17] [18] [19] [20] [21] [22] have motivated the 
study of Controlled Quantum Secure Direct Communication (CQSDC) proto¬ 
cols, where a message can be sent by a sender to the intended recipient, who 
can only recover the message, with the permission/cooperation of a controller. 
CQSDCs can be perceived a more general form of QSDC. Any CQSDC scheme 
can be reduced and made operationally equivalent to a(n) (Interactive) QSDC 
scheme by simply allowing the sender to assume the role of the controller in 
addition. In this paper, we report a simple construction of a CQSDC scheme 
using Cluster state, that is feasible to implement using the current technolo¬ 
gies. It is demonstrably shown to be more efficient than the existing protocols 
[18] [20] [ 21 ] while mainlining the same security specifications. Also unlike the 
existing schemes, the proposed one also does not need entanglement swapping. 
We further give a construction of a (2-3)-CQSDC using Brown state, where at 
least two of the three controllers must form a coalition to recover the message. 
This is the first proposal for a thresholding based CQSDC to the best of the 
authors’ knowledge. 


2 CQSDC with Cluster state 


The task of carrying out Controlled Quantum Secure Direct Communication 
is divided into two steps -Preparation Step and Retrieval Step. In the Prepa¬ 
ration Step the sender, Alice, encodes the message using suitable local unitary 
transformations on her subsystem, followed by measuring her subsystems. The 
Retrieval Step is where the receiver. Bob, requests permission of the controller, 
Charlie, to recover the message. Ideally, without Charlie’s permission. Bob 
must not be able to fully recover the message. 

A 4-qubit Cluster state is defined as 


\C),= 


( 10000 )+ 11001 )+ 10110 ) 

2 


( 1 ) 


To send two bit messages, a four-qubit Cluster state, IC 4 ), is used, such 
that two qubits are possessed by Alice, and one qubit by Bob and one qubit 
by Charlie, i.e., \C )is distributed as shown in Table 1. 

Table 1: Distribution of Qubits, of the Cluster state o, among the parties 


Party 

Qubits 

Alice 

01,02 

Bob 

hi 

Charlie 

Cl 
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In the Preparation Step, the secret message is encoded as shown in Ta¬ 
ble 2. Here X represents an operation of a X-Gate (Bit flip) on the qubit 
corresponding to the specihed column, and / represents an operation of a 
/-Gate (Identity) on the qubit. More concretely, X = (|0) (1| -I- |1) (0|) and 
/=(| 0 ) ( 0 | + | 1 )( 1 |) 

Table 2: Operations Alice applies on her qubits. 


Secret Message 

ai 

02 

00 

I 

I 

01 

X 

X 

10 

X 

I 

11 

I 

X 


Following that, Alice, Bob and Gharlie measure their systems and Alice 
sends her measurement outcomes (two c-bits) to Bob. During the Retrieval 
Step, Bob requests Gharlie to send his measurement outcome to Bob. Based 
on the information available to Bob (i.e., Alice’s measurement outcomes that 
Alice had sent in the Preparation Step, Bob’s measurement outcomes, and 
the measurement outcomes received from Gharlie), Bob consults the following 
table to recover the secret message. 


Table 3: Corresponding messages for possible measurement outcomes 


Alice’s 

Bob’s 

Charlie’s 

Secret 

Measurement 

Measurement 

Measurement 

Message 

00 

0 

0 


01 

1 

0 

00 

10 

0 

1 

11 

1 

1 


00 

1 

1 


01 

0 

1 

01 

10 

1 

0 

11 

0 

0 


00 

0 

1 


01 

1 

1 

10 

10 

0 

0 

11 

1 

0 


00 

1 

0 


01 

0 

0 

11 

10 

1 

1 

11 

0 

1 



To exemplify, suppose Alice wants to send a message 01 to Bob, then 
following the distribution of qubits as in Table 1, Alice applies an A o A to her 
system (as in Table 2) and measures it and reports the measurement outcome, 
say 61 , 62 , using an authenticated channel, to Bob. Bob now requests Charlie 
for his permission. Charlie measures his system forwards his measurement 
outcome, say 64 to Bob. Bob also measures his system to see 63 . Bob now 
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looks up Table 3 to identify the column for the tuple ( 6 i, 62 , ^ 3 , ^ 4 ) and be able 
to recover the message 01 . 


2.1 Security Analysis 

The security analysis of the protocol includes the analysis of the scheme with¬ 
out the permission of the controller and the condition, where all the classical 
information is displayed to Eve. 

2.1.1 Analysis of the scheme without the permission of Charlie 

Notice the distribution of classical bits due to measurement outcomes over 
the space messages (as in Table 3) is uniform in the length of message. Thus, 
in this case. Bob must need all 4 bits of classical information to identify the 
intended message sent to him. Without the permission of Charlie, he only 
has access to atmost 3 bits of information. If Bob has a better strategy than 
to guess Charlie’s bit, with a guessing probability > 1/2, then this violated 
Information Causality [23], which says the maximum information that Bob 
can gain about previously unknown knowledge, using all local resources and n 
classical bits, is at most n. However, with access to just Alice’s measurement 
outcomes, and his own measurement outcome. Bob does learn about learn 1 
bit of information. It can be seen, this 1 — bit information that Bob learns is 
the 2nd bit of the message. 

Thus, the probability that Bob can correctly guess the information Alice 
has sent without the permission of Charlie is given by, 

Pr(rnn = (A)\xyz) = Pr(rnn = Q\\xyz) = Pr(rnn = lQ\xyz) = Pr{mn = ll\xyz) = 1/2 

where mn, xy and z indicate the secret message, Alice’s reading and Bob’s 
reading respectively. 

2.1.2 Analysis of the scheme when all the classical information is displayed 

The same argument as in Section 2.1.1. can be used to convince the inability of 
an Evesdropper, Eve, who has access to all classical communication from Alice 
and Charlie, to predict the classical message. Due to the uniformity in the view 
of Bob and Charlie, the roles of the Eve and Bob in here can be perceived as 
Bob and Charlie in 2.1.1. The 1 bit of information that Eve learns here is the 
parity of the message. 

Thus, the probability that Eve can correctly guess the information when 
she has access to all the classical bits sent is given by, 

Pr(rnn = (A)\xyz) = Pr{mn = Q\\xyz) = Pr(rnn = lQ\xyz) = Pr(mn = ll\xyz) = 1/2 

where mn, xy and z indicate the secret message, Alice’s reading and Charlie’s 
reading respectively. 
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2.2 Efficiency 


The efficiency of the protocols can be measured using the following equations, 
as previously used in [18], [19], [2T] . 


mu 

qk + hk 


( 2 ) 


m = 


qk 


( 3 ) 


where rriu, qk and Ck denote the number of bits in the secret message, 
number of qubits used and the number of bits of classical communication used. 
Ideally, higher the value of rji and 772 , the more efficient the scheme would be. 

The values of the ryi and 772 for the proposed protocol along with the other 
protocols are given in the Table 4. 


Table 4: Comparison of efficiency of various protocols 


Protocol 

m 

m 

Dong et al. [IB] 

0.125 

0.25 

Kao et al. [TS] 

0.125 

0.25 

Hassanpour et al. [3T] 

0.22 

0.33 

Proposed Protocol 

0.28 

0.50 


It may be noted, unlike the other protocols, the proposed protocol doesn’t 
make use of Entanglement Swapping or other complex operations, however, as 
demonstrated, attains better efficiency than the existing ones. Also compared 
to other protocols, the proposed protocol is simpler to implement and is inex¬ 
pensive in terms of the number of gates and measurements required to realize 
this. 


3 (2-3)-CQSDC with Brown state 

A (2-3)-CQSDC is a thresholding based Controlled Quantum Secure Direct 
Communication, where a sender sends a two-bit message, that can be com¬ 
pletely recovered only when any two of three controllers form a coalition. To 
realize the protocol, a 5-qubit Brown state is used here. 

( 1001 ) \<p-) + 1010 ) \^-) + 1100 ) !<?>+) - 1111 ) \^+) 


where \<P^) = ^(|00) ± |11)) and |!f±) = -^(lOl) ± |10)). Brown state 
[24| have shown their utility to carry out diverse quantum tasks, including 
teleportation, quantum state sharing, superdense coding have been studied 
rather exhaustively [IS]. Here, to perform a (2-3) CQSDC, a 5-qubit Brown 
state, \B)^ b c d e distributed among the concerned parties - the sender, Alice, 
and the controllers, Charliel, Charlie2, Charlie3, as in Table 5. 









6 


Patwardhan, Roy Moulick, Panigrahi 


Table 5: Distribution of Qubits of the Brown state among the parties 


Party 

Qubits 

Alice 

d, e 

Gharliel 

a 

Charlie2 

b 

Charlies 

c 


In the Preparation Step, to encode a two bit message, Alice applies the 
suitable unitaries on her subsystem as described in the Table 6 , where X 
represents an operation of a A-Gate (Bit flip) on the qubit, I represents an 
operation of a /-Gate (Identity) on the qubit and Z represents an operation 
of a Z-Gate(phase flip) on the qubit. More concretely, / = (|0) (0| -I- |1) (1|), 
A = (|0)(1| + |1)(0|),Z = (|0) {0|-|1)(1|) 


Table 6 : Operations Alice applies on her qubits. 


Secret Message 

Ol 

ai 

00 

I 

I 

01 

z 

X 

10 

z 

I 

11 

I 

X 


Following that, Alice, and the controllers, Gharliel, Gharlie2, and GharlieS 
measure their qubits, and Alice sends her measurement outcomes to all the 
controllers. 

In the Retrieval Step, at least two of the three controllers, must come 
together and collaborate to get the secret message. Based on the distribution 
as in Table 7, it may be noted, given Alice’s Measurements are known to all, 
the coalition of two controllers is necessary and sufficient to recover the secret 
message. 

It may be noted that it is possible for any of the controllers to presume 
the role of Bob during the protocol. It is also possible for at-most two of 
the three controllers to recover the message, privately with the permission of 
another controller. Suppose Alice wants to send a message 10. Following the 
distribution of qubits as in Table 5, Alice applies the operation Z (g) X to 
her subsystem (as in Table 6 ) and measures it to see an outcome, say 5 i ,62 
and sends her outcomes to the intended recipient (say Gharliei). Gharliei now 
measures his system, to see 63 and with the permission of Gharliej,(i 7 ^ j), 
who, on consent, measures his own system to see and correctly reports 64, now 
has a tuple ( 61 , 62 , ^ 3 , 64 ) can recover the intended message Alice had send, by 
looking up Table 7. 
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Table 7: Corresponding messages for possible measurement outcomes 


Alice’s 

Charliel’s 

Charlie2’s 

CharlieS’s 

Secret 

Measurement 

Measurement 

Measurement 

Measurement 

Message 

(t>~ 

0 

0 

1 


f}- 

0 

1 

0 

00 

(j)+ 

1 

0 

0 


1 

1 

1 


if- 

0 

0 

1 



0 

1 

0 

01 

iJF 

1 

0 

0 

ct)+ 

1 

1 

1 


4,+ 

0 

0 

1 


ijF 

0 

1 

0 

10 

(t>~ 

1 

0 

0 

if- 

1 

1 

1 


if+ 

0 

0 

1 


4+ 

0 

1 

0 

11 

if- 

1 

0 

0 


1 

1 

1 



3.1 Security Analysis 

3.1.1 Analysis of the scheme without the permission of a second controller 

Notice the distribution of classical bits due to measurement outcomes of Alice 
and any two Charlioi and Charlie^, over space space of messages is uniform, 
as in Table 7. Hence to for a Charlie^, recover the message, he needs 4 bits 
of information. Without the permission of a second controller, Charlie^ has 
access to only 3 bits of information. If Bob could design a better strategy 
than randomly guessing the second controller’s measurement outcome with 
probability greater than then he violates Information Causality [23], in the 
same spirit as argued in Section 2.1.1. Hence, The probability that only one 
of the three can correctly guess the information Alice has sent without the 
permission of a second controller is given by, 

Pr{mn = Qt)\xyz) = Pr{mn = t)l\xyz) = Pr(jnn = lQ\xyz) = Pr(jnn = \\\xyz) 

where mn is the secret message, xy is Alice’s measurement outcome and z is 
the measurement outcome of Charlie^. 

3.1.2 Analysis of the scheme when all the classical information is displayed 

An eavesdropper. Eve, who sees the classical communication between Alice 
and one of the Charlie’s, say Charlie^, has access to 3 bits of information. 
Of-course, if both two of the controller’s, Charlie^, Charlier^ in the protocol 
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want to help Charliei, Eve learns 4 bits of information, and can figure out the 
intended message. However this can be avoided, by letting only one controller 
to control the permission. In a case where both controllers want to help, only 
one must send out the classical bits. Now, given 3 bits of information to Eve, 
one can build up the same argument as in Section 3.1.1, with Eve and Charliei 
(here) playing the role of Charliei and Charliejorfc (as in 3.1.1), to claim, 
given 3-bits of information an eavesdropper can figure out the message, then 
it violates Information Causality [23]. 

Hence, The probability that Eve can correctly guess the information when 
she has access to all the classical bits sent is given by, 

Pr{mn = 00|xyz) = Pr{mn = 01\xyz) = Pr{mn = lQ\xyz) = Pr{mn = \\\xyz) 

where mn, xy and z indicate the secret message, Alice’s reading and Charlie’s 
reading respectively. 


3.2 Efficiency 

The values of 771 and 772 for the proposed protocol, computed based on Eq. [5] 
and Eq. [3|are 0.25 and 0.40. 

The exquisite nature of the five qubit Brown state, where two of the parti¬ 
cles are entangled as Bell States makes it possible to use Brown state in such 
a conditionally controlled communication scheme. 


4 Conclusion 

We have presented here two efficient protocols for Controlled Quantum Secure 
Direct Communication. The first one is an unidirectional CQSDC scheme, 
involving a sender, controller and a receiver, that makes use of Cluster state, 
where the sender sends two bit messages to the receiver who recovers the 
message with the help of a controller. We analyze the security and efficiency 
of the proposed scheme and report it to be more efficient than the existing 
protocols while maintaining the same security specifications. Following that, 
we introduce a thresholding based (2-3)-CQSDC scheme using Brown state, 
involving a sender and three controllers, where only two controllers need to 
collude to recover a two bit message sent by a sender. 
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